CVE-2025-61597

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
emlog	emlog	< 2.5.22

References

https://github.com/emlog/emlog/pull/179Patch
https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4mExploit, Third Party Advisory

Timeline

Published: Oct 3, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-615985.3Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-s CVE-2025-615995.4Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG P CVE-2025-61609.8A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affect CVE-2025-616007.5Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP prot CVE-2025-616017.5BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authentica CVE-2025-616027.5BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authentica CVE-2025-616039.8WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in CVE-2025-616047.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery CVE-2025-616059.8WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerabilit CVE-2025-616066.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerabilit CVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition CVE-2025-616087.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition